Rebuild comment sync as a post-merge repair caller - #158
Merged
Conversation
Replaces the in-PR workflow_run caller: any non-Dependabot push to a Dependabot branch flips the retriggered runs' actor off dependabot[bot], lifting the Dependabot sandbox for the PR's unreviewed action bumps (verified live on basecamp-cli#566; see basecamp/.github#11). The reusable workflow now runs post-merge: on workflow-file pushes to the default branch it repairs drifted comments via a comment-only auto-merging PR — only reviewed code ever executes. Dependabot itself maintains the bare comments on its own PRs after the bare-pin restructure. Lands disabled; enabled per repo after a full-cycle exercise.
There was a problem hiding this comment.
Pull request overview
This PR refactors the repo’s Dependabot action-pin comment synchronization workflow to stop running in-PR logic and instead delegate to a SHA-pinned reusable workflow intended to run post-merge on main, opening an auto-merge “comment-only” repair PR when drift is detected.
Changes:
- Replaces the previous
workflow_run-driven in-repo implementation with a reusable workflow call pinned tobasecamp/.githubcommit45d3fc95…. - Switches the trigger to
pushonmain(workflow-file path filtered) plus manualworkflow_dispatch. - Uses
secrets: inheritand job-level token permissions for the reusable workflow’s PR/Actions operations.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the in-PR
workflow_runcaller with the post-merge model (basecamp/.github#11, pinned 45d3fc95): any non-Dependabot push to a Dependabot branch flips the retriggered runs' actor offdependabot[bot], lifting the Dependabot sandbox for the PR's unreviewed action bumps — verified live on basecamp/basecamp-cli#566. Post-merge, the reusable workflow repairs drifted comments via a comment-only auto-merging PR; every pin it touches is already reviewed, and nothing is ever pushed to a Dependabot branch. Dependabot maintains the bare comments on its own PRs after the bare-pin restructure (Layer 1, merged fleet-wide).The workflow entry stays disabled through this merge; repos are enabled one at a time after a full-cycle exercise (seeded drift → repair PR → held-run approval → CI → auto-merge → terminal no-op) in one repo.